araj - Malicious user can DoS honest BribeRewarder by creating MAX_BRIBES_PER_POOL with very small amount

[sherlock-admin3]

araj

Medium

Malicious user can DoS honest BribeRewarder by creating MAX_BRIBES_PER_POOL with very small amount

Summary

Malicious user can DoS honest BribeRewarder by creating MAX_BRIBES_PER_POOL with very small amount

Vulnerability Detail

Voter.sol allow any user to create/register bribeRewarder for any pool and max bribe that can be created per votingPeriod per pool is 5 ie MAX_BRIBES_PER_POOL

 uint256 internal constant MAX_BRIBES_PER_POOL = 5;

function onRegister() external override {
...
        (address pool, uint256[] memory periods) = rewarder.getBribePeriods();
        for (uint256 i = 0; i < periods.length; ++i) {
            // TODO check if rewarder token + pool  is already registered

            require(periods[i] >= currentPeriodId, "wrong period");
       @>   require(_bribesPerPriod[periods[i]][pool].length + 1 <= Constants.MAX_BRIBES_PER_POOL, "too much bribes");
            _bribesPerPriod[periods[i]][pool].push(rewarder);
        }
    }

A malicious user can take advantage of this MAX_BRIBES_PER_POOL to create multiple(5) bribeRewarder for multiple votingPeriod for a specific pool which he wants to DoS with very little amount(amountPerPeriod)

//How this works:

1. Suppose an honest user wanted to bribe for poolA to pass the minVotes or to attract voters
2. Malicious user saw this and created 5 bibeRewarder for the same poolA & bribe it from currentVotingPeriod to till he wants to DoS with amountPerPeriod = 1 wei
3. This will register the all 5 bribeRewarder to voter.sol contract( in _bribesPerPriod mapping)
4. When honest user will try to register the real bribeRewarder, it will revert due to MAX_BRIBES_PER_POOL( see above code )

Note: All this can be done with very little amount ie as little as 5 wei( 5 bibeRewarder * 1 wei )

Impact

Honest pool can be DoSed with very little amount

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/libraries/Constants.sol#L17
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L130C4-L144C6

Tool used

Manual Review

Recommendation

There are couple of ways:

1. Set min amountPerPeriod in BribeRewarder that is required while bribing
2. Charge min fee when a user register for BribeRewarder in Voter.sol

Duplicate of #190